The Initia blockchain was halted Tuesday morning after suffering its second security incident in less than three weeks. An infrastructure key compromise led to at least $615,000 in losses which, when added to the $2.7 million lost in October, totals more than the chain’s remaining total value locked (TVL).
The Initia L1 was halted at 06:18 UTC on November 10 in coordination with validators as a protective measure.
On Tuesday morning, the Initia X account announced a chain halt in response to the discovery of “unauthorized transfers from the escrow accounts on the Initia L1 that hold assets bridged to several rollups.”
The post blamed “compromised rollup infrastructure keys allowing an attacker to fabricate IBC transfers” and tallied $615,000 that made it off-chain. However, “most” of the assets removed from escrow accounts remain on Initia, indicating that they may be recoverable via validator coordination.
Second hack in three weeks
Tuesday’s hack comes less than three weeks after a script caching bug let an attacker “artificially [spoof] the MoveVM state, thereby crediting themselves with unbacked WETH, iUSD, and USDC tokens.”
That incident led to $2.7 million in losses bridged to Ethereum, and was also met with a halt of Initia chain and its rollups. They came back online on November 2 before being hacked again eight days later.
The combined losses of $3.3 million across the two incidents is greater than Initia’s remaining TVL, which is down over 90% from its peak shortly after launching in May last year.
Reactions to this most recent incident have been aggressive, with users urging the chain to shut down and accusing the team of an inside job. Strangely, Initia’s INIT token is up around 60% over the last 24 hours, leading to suspicions of a “crime pump” from frustrated users.
